[GH] (pekko/remote-deploy-allowlist-ordering): Workflow run "Pull Requests" is working again!

[GitBox <gi...@apache.org>]

The GitHub Actions job "Pull Requests" on pekko.git/remote-deploy-allowlist-ordering has succeeded.
Run started by GitHub user pjfanning (triggered by pjfanning).

Head commit for run:
cee2d8ca2f3c62fa22c42d9e5101bd540188dbcf / PJ Fanning <pj...@users.noreply.github.com>
fix: check the remote deployment allow list before deserializing constructor args

Motivation:
DaemonMsgCreateSerializer.fromBinary loaded the peer-named actor class and then
deserialized every constructor argument - with peer-chosen serializer ids and
manifests - before RemoteSystemDaemon consulted the remote deployment allow
list. For a class the allow list rejects, that deserialization is attack surface
taken on for a deployment that is refused moments later, which weakens the
guarantee the allow list is credited with.

Modification:
Extract RemoteDeploymentAllowList, holding the two existing config keys and the
class-name comparison, and use it from both RemoteSystemDaemon and
DaemonMsgCreateSerializer so the two cannot drift. The serializer now checks the
allow list immediately after resolving the actor class and before deserializing
any argument, logging at error with LogMarker.Security and the same exception
RemoteSystemDaemon raises.

Result:
With the allow list enabled, a rejected class is refused before any
peer-supplied argument is deserialized. No new configuration, and no change
when the allow list is off, which is the default.

Tests:
- sbt "remote/testOnly org.apache.pekko.remote.serialization.DaemonMsgCreateSerializerAllowListSpec org.apache.pekko.remote.serialization.DaemonMsgCreateSerializerAllowListDisabledSpec" - new, incl. a counting serializer asserting args are not deserialized for a rejected class
- sbt "remote/testOnly org.apache.pekko.remote.classic.RemoteDeploymentAllowListSpec org.apache.pekko.remote.serialization.DaemonMsgCreateSerializerAllowJavaSerializationSpec org.apache.pekko.remote.serialization.DaemonMsgCreateSerializerNoJavaSerializationSpec" - existing specs pass unchanged
- sbt "remote/mimaReportBinaryIssues" - no issues

References:
Refs #3478

Report URL: https://github.com/apache/pekko/actions/runs/33334558828

With regards,
GitHub Actions via GitBox


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For additional commands, e-mail: notifications-help@pekko.apache.org